Stored XSS and Open Redirect in n8n Workflow Form Node

Compliance Impact

The provided information does not specify how the CVE-2026-56354 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56354 is a vulnerability in the n8n workflow automation tool affecting versions before 1.123.24, 2.10.4, and 2.12.0. It involves cross-site scripting (XSS) and open redirect issues in the Form Node component.

The root cause is unsanitized HTML description fields and overly permissive iframe sandbox policies, which allow authenticated users with workflow creation permissions to inject malicious scripts or redirect parameters.

This enables stored XSS attacks or phishing redirects against other users interacting with the affected forms.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by authenticated users who have workflow creation or modification permissions to inject malicious scripts or redirect users to arbitrary external URLs.

The impact includes the possibility of stored cross-site scripting attacks, which can execute malicious code in the context of other users, and phishing redirects that can lead users to fraudulent websites.

Such attacks can compromise user trust, lead to credential theft, or facilitate further exploitation of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves cross-site scripting (XSS) and open redirect issues in the Form Node of n8n due to unsanitized HTML description fields and permissive iframe sandbox policies. Detection typically requires reviewing the versions of n8n in use and inspecting workflow creation permissions and Form Node configurations.

Specifically, you can check the n8n version to see if it is before 1.123.24, 2.10.4, or 2.12.0, which are the patched versions.

While no explicit detection commands are provided, you can use commands to identify the n8n version running on your system, for example:

• Check n8n version via CLI: `n8n --version`
• Review running containers or processes for n8n version tags, e.g., `docker ps` and `docker inspect <container_id>` if using Docker.
• Audit user permissions to identify users with workflow creation rights who could exploit the vulnerability.

To detect exploitation attempts, monitor logs for unusual script injections or redirects in Form Node workflows, although specific commands for this are not detailed in the provided resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating n8n to the patched versions 1.123.24, 2.10.4, or 2.12.0, which address the cross-site scripting and open redirect vulnerabilities in the Form Node.

If immediate updating is not possible, temporary mitigations include restricting workflow creation permissions to trusted users only.

Another temporary measure is to disable the Form and Form Trigger nodes via environment variables to prevent exploitation.

These steps reduce the risk of stored XSS attacks or phishing redirects by limiting the ability of attackers to inject malicious scripts or redirect parameters.

Useful 0 Not Useful 0